An outstretched middle finger is an unmistakable signal, even if the finger is not shown at all, but only circumscribed in a flowery way.
Enter Moxie Marlinspike: All in one blog post published on Wednesday, which can confidently be described as punk PR, the developer of the popular messenger app Signal shows an IT forensics company from Israel the middle finger. The company is called Cellebrite, and it is best known among law enforcement officers, primarily for its solutions for unlocking and reading confiscated smartphones, which can also include signal chats. They are transmitted end-to-end encrypted, so they cannot be read remotely, but if investigators can read the source directly, the protection is gone.
–
For Marlinspike, who is committed to uncompromising commitment to signal users, this is where things get personal. Cellebrite’s customer list, Marlinspike begins his blog post, includes “authoritarian regimes in Belarus, Russia, Venezuela and China, death squadrons in Bangladesh, the military junta in Myanmar and oppressors in Turkey, the United Arab Emirates and elsewhere.” So far, so dark.
–
Fell off the truck
But then the tone of voice changes and the blog post suddenly becomes a rogue: »By a really unbelievable coincidence, I was out for a walk the other day when a small package fell from the truck in front of my eyes. As I got closer, the dreary company logo slowly became recognizable: Cellebrite. We found the current version of the Cellebrite software in the package. ”Underneath, Marlinspike placed a photo of a Cellebrite bag lying unpacked, undamaged and clean on the street.
–
This brought the unconventional app developer to the core: he examined the software, he writes, and found weaknesses in it that, according to his presentation, allow the forensics tool to be hacked and manipulated at will. A smartphone app can be programmed in such a way that it completely falsifies the results of every Cellebrite analysis, i.e. makes any evidence on a confiscated device unusable, he claims.
He immediately published a video to prove it, accompanied by scenes and quotes from the 1995 film “Hackers”, such as “mess with the best, die with the rest” (in the German version it says “Put on the best, and then you die like everyone else «).
–
Marlinspike writes that he “of course” likes to reveal details to Cellebrite – but only if the Israeli company for its part uncover all the weak points it uses to read devices, “now and in the future.”
–
The blog post closes with a paragraph that supposedly has absolutely nothing to do with what was previously described and that future versions of the Signal app will regularly load files into its memory: “These files are never used or interacted for anything within Signal never with Signals software or Signal data, but they look nice and aesthetics are important in software «. Loosely translated: Marlinspike threatens to convert Signal in such a way that the app sabotages the reading of the smartphone via Cellebrite software in the event of an emergency.
–
